YazFi and dns setting for guess network

[lepa71]

I'm wondering if I should have DNSs on the guest network to be some public DNS(1.1.1.1) or the default of subnet 192.168.2.1 like.

 

[Tech9]

If you expect guests with kids and their phones/tablets - use something like OpenDNS Family Shield, CleanBrowsing Family Filter, Cloudflare for Families, etc. You don't want the kids accessing some adult content when connected to your Wi-Fi, perhaps restricted on their own Wi-Fi at home.

 

[lepa71]

I'm actually using this 2.4 guest network for IoT devices.

 

[Tech9]

Then your default router DNS is perhaps good enough.

 

[lepa71]

This is what my wan dns looks like

And this is what default YazFI looks like. Is it ok or should put the main router IP there instead of 192.168.2.1. My router IP is 192.168.50.1

 

[Tech9]

I would keep Quad9 or Cloudflare, but not both. If you have no IPv6 enabled you don't need the IPv6 DNS servers listed. Keep IPv6 disabled, if you don't need IPv6. Leave YazFi settings on default- good enough for your IoT devices. I would also leave the three settings above "Prevent auto client DoH" on default No. Profile to Strict ensures DoT use - keep it this way.

In general DoT will slow down your DNS queries. It depends on the DoT server load. You're hiding the actual queries, but your ISP knows what servers you connect to exactly by IP address and still can recreate your browsing history quite accurately, if they want to. No much "privacy" here.

 

[lepa71]

My new Verizon 5 g internet has issues with IPv6 so those are leftovers from the prior setup. I just never cleaned that up. IPv6 is disabled. So 192.168.2.1 is fine or should it be 192.168.50.1 for the guest network?

 

[Tech9]

I don't use YazFi. If it works in default configuration - leave it alone. You can check what DNS servers are used by connecting to this Guest Network and clicking on one of the links below. What you'll see with your current configuration is perhaps a mix of Cloudflare and Quad9 servers.

dnscheck.tools - check your dns resolvers

A tool to test for DNS leaks, DNSSEC validation, and more

dnscheck.tools

DNS Leak Test

The DNS Leak Test is a tool used to determine which DNS servers your browser is using to resolve domain names. This test attempts to resolve 50 randomly generated domain names, of which 25 are IPv4-only and 25 are IPv6-only.

browserleaks.com

 

[bennor]

For YazFi DNS fields you can use your router's IP address, or use a public DNS server(s), or use Pi-Hole if one has a Pi-Hole setup. For example if your router's IP address is 192.168.1.1 or 192.168.50.1 then enter the appropriate IP address in the YazFi DNS field(s).

Some additional comments. YazFi does not work on AiMesh nodes which you indicated you are using in your other recent post. See JackYaz's comment here about nodes. Make sure to use unique IP addresses for each of the Guest Networks. You can do extra or additional scripting to do things like reserve IP addresses for YazFi Guest Network clients (see my post here on that), or configure traffic between Guest networks (see here for one example), or allow a single LAN client to access a Guest Network client (see this discussion for that). See the YazFi Wiki for more along with use this subforum's Filter option to filter for YazFi to find the many past discussions on this script and additional tweeks that can be made to it.